A company's security policy requires that access to its internal database servers should be denied from all external IP addresses except from its own VPN network, which has an IP range of 10.200.0.0/16. As a security administrator, which of the following rules should you apply to BEST meet the security policy requirement?
Allow from 192.168.1.0/24
Allow from all, Deny from 10.200.0.0/16
Deny from 10.200.1.0/24
Deny from all, Allow from 10.200.0.0/16